Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-06 06:00:15 +01:00
Code Issues Projects Releases Packages Wiki Activity

Propagate destination through load_data (#37020)

Browse source 
This way, we don't always set the destination to Document (which is as
the spec is written today). Instead, we set it it in the load_data,
depending on which context we load it from.

Doing so allows us to set the `Destination::IFrame` for navigations in
iframes, enabling all frame-related CSP checks.

While we currently block iframes when `frame-src` or `child-src` is set,
their respective tests don't pass yet. That's because we don't yet
handle the cases
where we fire the correct `load` event.

Also update one WPT test to correctly fail, rather than erroring. That's
because it was using the wrong JS test variable.

Part of #4577

Signed-off-by: Tim van der Lippe <tvanderlippe@gmail.com>
Co-authored-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
Tim van der Lippe 2025-05-17 10:22:11 +02:00 • committed by GitHub
parent a028291466
commit ed469fe72f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 17 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

5
components/shared/constellation/from_script_message.rs
View file

@ -23,7 +23,7 @@ use http::{HeaderMap, Method};
use ipc_channel::Error as IpcError;
use ipc_channel::ipc::{IpcReceiver, IpcSender};
use net_traits::policy_container::PolicyContainer;
use net_traits::request::{InsecureRequestsPolicy, Referrer, RequestBody};
use net_traits::request::{Destination, InsecureRequestsPolicy, Referrer, RequestBody};
use net_traits::storage_thread::StorageType;
use net_traits::{CoreResourceMsg, ReferrerPolicy, ResourceThreads};
use profile_traits::mem::MemoryReportResult;
@ -111,6 +111,8 @@ pub struct LoadData {
pub has_trustworthy_ancestor_origin: bool,
/// Servo internal: if crash details are present, trigger a crash error page with these details.
pub crash: Option<String>,
/// Destination, used for CSP checks
pub destination: Destination,
}
/// The result of evaluating a javascript scheme url.
@ -152,6 +154,7 @@ impl LoadData {
crash: None,
inherited_insecure_requests_policy,
has_trustworthy_ancestor_origin,
destination: Destination::Document,
}
}
}